rpms/mariadb
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS mariadb-10.5.29-5.el9

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-24 09:23:27 -04:00
parent e9c65f4843
commit 3256330065
5 changed files with 320 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

207
SOURCES/CVE-2025-13699.patch Normal file
View File

@ -0,0 +1,207 @@
diff --git a/client/mysqldump.c b/client/mysqldump.c
index e7264c07..7a019f97 100644
--- a/client/mysqldump.c
+++ b/client/mysqldump.c
@@ -1811,6 +1811,26 @@ static char *cover_definer_clause(const char *stmt_str,
return query_str;
}
+
+static const char* build_path_for_table(char *to, const char *dir,
+ const char *table, const char *ext)
+{
+ char filename[FN_REFLEN], tmp_path[FN_REFLEN];
+ convert_dirname(tmp_path, path, NULL);
+ my_load_path(tmp_path, tmp_path, NULL);
+ if (check_if_legal_tablename(table))
+ strxnmov(filename, sizeof(filename) - 1, table, "@@@", NULL);
+ else
+ {
+ uint errors, len;
+ len= my_convert(filename, sizeof(filename) - 1, &my_charset_filename,
+ table, (uint32)strlen(table), charset_info, &errors);
+ filename[len]= 0;
+ }
+ return fn_format(to, filename, tmp_path, ext, MYF(MY_UNPACK_FILENAME));
+}
+
+
/*
Open a new .sql file to dump the table or view into
@@ -1825,12 +1845,9 @@ static char *cover_definer_clause(const char *stmt_str,
*/
static FILE* open_sql_file_for_table(const char* table, int flags)
{
- FILE* res;
- char filename[FN_REFLEN], tmp_path[FN_REFLEN];
- convert_dirname(tmp_path,path,NullS);
- res= my_fopen(fn_format(filename, table, tmp_path, ".sql", 4),
- flags, MYF(MY_WME));
- return res;
+ char filename[FN_REFLEN];
+ return my_fopen(build_path_for_table(filename, path, table, ".sql"),
+ flags, MYF(MY_WME));
}
@@ -4017,15 +4034,9 @@ static void dump_table(const char *table, const char *db, const uchar *hash_key,
if (path)
{
- char filename[FN_REFLEN], tmp_path[FN_REFLEN];
+ char filename[FN_REFLEN];
- /*
- Convert the path to native os format
- and resolve to the full filepath.
- */
- convert_dirname(tmp_path,path,NullS);
- my_load_path(tmp_path, tmp_path, NULL);
- fn_format(filename, table, tmp_path, ".txt", MYF(MY_UNPACK_FILENAME));
+ build_path_for_table(filename, path, table, ".txt");
/* Must delete the file that 'INTO OUTFILE' will write to */
my_delete(filename, MYF(0));
@@ -4034,7 +4045,6 @@ static void dump_table(const char *table, const char *db, const uchar *hash_key,
to_unix_path(filename);
/* now build the query string */
-
dynstr_append_checked(&query_string, "SELECT /*!40001 SQL_NO_CACHE */ ");
dynstr_append_checked(&query_string, select_field_names.str);
dynstr_append_checked(&query_string, " INTO OUTFILE '");
diff --git a/client/mysqlimport.c b/client/mysqlimport.c
index 687fd8c2..402affcf 100644
--- a/client/mysqlimport.c
+++ b/client/mysqlimport.c
@@ -317,7 +317,17 @@ static int write_to_table(char *filename, MYSQL *mysql)
DBUG_ENTER("write_to_table");
DBUG_PRINT("enter",("filename: %s",filename));
- fn_format(tablename, filename, "", "", 1 | 2); /* removes path & ext. */
+ fn_format(tablename, filename, "", "", MYF(MY_REPLACE_DIR | MY_REPLACE_EXT));
+ if (strchr(tablename, '@'))
+ {
+ uint errors, len;
+ CHARSET_INFO *cs=
+ get_charset_by_csname(default_charset, MY_CS_PRIMARY, MYF(0));
+ len= my_convert(escaped_name, sizeof(escaped_name) - 1, cs, tablename,
+ (uint32)strlen(tablename), &my_charset_filename, &errors);
+ if (!errors)
+ strmake(tablename, escaped_name, len);
+ }
if (!opt_local_file)
strmov(hard_path,filename);
else
@@ -466,7 +476,7 @@ static MYSQL *db_connect(char *host, char *database,
mysql_options(mysql, MYSQL_DEFAULT_AUTH, opt_default_auth);
if (!strcmp(default_charset,MYSQL_AUTODETECT_CHARSET_NAME))
default_charset= (char *)my_default_csname();
- mysql_options(mysql, MYSQL_SET_CHARSET_NAME, my_default_csname());
+ mysql_options(mysql, MYSQL_SET_CHARSET_NAME, default_charset);
mysql_options(mysql, MYSQL_OPT_CONNECT_ATTR_RESET, 0);
mysql_options4(mysql, MYSQL_OPT_CONNECT_ATTR_ADD,
"program_name", "mysqlimport");
diff --git a/mysql-test/main/mysqldump.result b/mysql-test/main/mysqldump.result
index 8e8e342d..4a9c1b50 100644
--- a/mysql-test/main/mysqldump.result
+++ b/mysql-test/main/mysqldump.result
@@ -6624,3 +6624,48 @@ SET character_set_client = @saved_cs_client;
drop view `v'1"2`;
drop table t1;
# End of 10.5 tests
+#
+# MDEV-37483 mariadb-dump -T doesn't convert table names
+#
+create database foo;
+use foo;
+create table `con_schöne_grüße` (a int) select 1 as a;
+create table `con` (b int) select 2 as b;
+create table `con/bar` (c int) select 3 as c;
+create table `con@fame` (d int) select 4 as d;
+drop database foo;
+use test;
+con@002fbar.sql
+con@002fbar.txt
+con@@@.sql
+con@@@.txt
+con@fame.sql
+con@fame.txt
+con_sch@1ine_gr@1o@1je.sql
+con_sch@1ine_gr@1o@1je.txt
+show tables;
+Tables_in_test
+con
+con/bar
+con@fame
+con_schöne_grüße
+test.con: Records: 1 Deleted: 0 Skipped: 0 Warnings: 0
+test.con/bar: Records: 1 Deleted: 0 Skipped: 0 Warnings: 0
+test.con@fame: Records: 1 Deleted: 0 Skipped: 0 Warnings: 0
+select * from `con_schöne_grüße`;
+a
+1
+select * from `con`;
+b
+2
+select * from `con/bar`;
+c
+3
+select * from `con@fame`;
+d
+4
+drop table `con_schöne_grüße`;
+drop table `con`;
+drop table `con/bar`;
+drop table `con@fame`;
+# End of 10.6 tests
diff --git a/mysql-test/main/mysqldump.test b/mysql-test/main/mysqldump.test
index 58790c15..6dc3eff5 100644
--- a/mysql-test/main/mysqldump.test
+++ b/mysql-test/main/mysqldump.test
@@ -3033,3 +3033,44 @@ drop view `v'1"2`; # "'
drop table t1;
--echo # End of 10.5 tests
+
+--echo #
+--echo # MDEV-37483 mariadb-dump -T doesn't convert table names
+--echo #
+create database foo;
+use foo;
+
+create table `con_schöne_grüße` (a int) select 1 as a;
+create table `con` (b int) select 2 as b;
+create table `con/bar` (c int) select 3 as c;
+create table `con@fame` (d int) select 4 as d;
+exec $MYSQL_DUMP foo --tab $MYSQLTEST_VARDIR/tmp;
+drop database foo;
+use test;
+move_file $MYSQLTEST_VARDIR/tmp/con@0040fame.sql $MYSQLTEST_VARDIR/tmp/con@fame.sql;
+move_file $MYSQLTEST_VARDIR/tmp/con@0040fame.txt $MYSQLTEST_VARDIR/tmp/con@fame.txt;
+list_files $MYSQLTEST_VARDIR/tmp con*;
+exec $MYSQL test < $MYSQLTEST_VARDIR/tmp/con@@@.sql;
+exec $MYSQL test < $MYSQLTEST_VARDIR/tmp/con@002fbar.sql;
+exec $MYSQL test < $MYSQLTEST_VARDIR/tmp/con_sch@1ine_gr@1o@1je.sql;
+exec $MYSQL test < $MYSQLTEST_VARDIR/tmp/con@fame.sql;
+show tables;
+exec $MYSQL_IMPORT test $MYSQLTEST_VARDIR/tmp/con@@@.txt;
+exec $MYSQL_IMPORT test $MYSQLTEST_VARDIR/tmp/con@002fbar.txt;
+if (`select @@version like '10.6.%'`) {
+# utf8 console output on Windows is fixed in MDEV-26713, until then
+--disable_result_log
+}
+exec $MYSQL_IMPORT --default-character-set=utf8mb4 test $MYSQLTEST_VARDIR/tmp/con_sch@1ine_gr@1o@1je.txt;
+--enable_result_log
+exec $MYSQL_IMPORT test $MYSQLTEST_VARDIR/tmp/con@fame.txt;
+select * from `con_schöne_grüße`;
+select * from `con`;
+select * from `con/bar`;
+select * from `con@fame`;
+drop table `con_schöne_grüße`;
+drop table `con`;
+drop table `con/bar`;
+drop table `con@fame`;
+
+--echo # End of 10.6 tests

78
SOURCES/mariadb-mdev-37899-selinux-avc.patch Normal file
View File

@ -0,0 +1,78 @@
From 5a8cd03f0f3ae9fbcc3b6f33843d030d840f6e2f Mon Sep 17 00:00:00 2001
From: Daniel Black <daniel@mariadb.org>
Date: Mon, 20 Oct 2025 18:45:56 +1100
Subject: [PATCH] MDEV-37899 galera sst generates numerous selinux AVCs when
starting
From downstream bug RHEL-116757, the use of ss to map all the
usage of ports to pids and process names under selinux is rather
limited by the mysqld_exec_t limitations.
The checking of the mapping is a bit excessive in a selinux
environment where binding is limited.
We replace the use of ss under selinux to raw reading of the
/proc/tcp{,} interfaces of the linux that aren't selinux restricted.
---
scripts/wsrep_sst_common.sh | 13 ++++++++++++-
scripts/wsrep_sst_rsync.sh | 9 +++++++--
2 files changed, 19 insertions(+), 3 deletions(-)
diff --git a/scripts/wsrep_sst_common.sh b/scripts/wsrep_sst_common.sh
index f23707c497acd..db6415b5d1e3a 100644
--- a/scripts/wsrep_sst_common.sh
+++ b/scripts/wsrep_sst_common.sh
@@ -1230,6 +1230,13 @@ check_sockets_utils()
lsof_available=0
sockstat_available=0
ss_available=0
+ raw_socket_check=0
+
+ if [ -n "$(commandex selinuxenabled)" ] && selinuxenabled; then
+ raw_socket_check=1
+ wsrep_log_info "/proc/net/tcp{,6} is being used directly to avoid excessive selinux AVC notices"
+ return 0
+ fi
socket_utility="$(commandex ss)"
if [ -n "$socket_utility" ]; then
@@ -1298,7 +1305,11 @@ check_port()
local rc=2 # ENOENT
- if [ $ss_available -ne 0 ]; then
+ if [ $raw_socket_check -ne 0 ]; then
+ for key in $(awk -v p="$port" 'BEGIN { hex_port = sprintf(":%04X", p) } $2 ~ hex_port && $4 == "0A" { print $10 }' /proc/net/tcp /proc/net/tcp6); do
+ return 0
+ done
+ elif [ $ss_available -ne 0 ]; then
$socket_utility $ss_opts -t "( sport = :$port )" 2>/dev/null | \
grep -q -E "[[:space:]]users:[[:space:]]?\\(.*\\(\"($utils)[^[:space:]]*\"[^)]*,pid=$pid(,[^)]*)?\\)" && rc=0
elif [ $sockstat_available -ne 0 ]; then
diff --git a/scripts/wsrep_sst_rsync.sh b/scripts/wsrep_sst_rsync.sh
index 361cef4a9fc67..5b7efbf3b60d9 100644
--- a/scripts/wsrep_sst_rsync.sh
+++ b/scripts/wsrep_sst_rsync.sh
@@ -105,7 +105,9 @@ check_pid_and_port()
local final
if ! check_port $pid "$port" "$utils"; then
- if [ $ss_available -ne 0 -o $sockstat_available -ne 0 ]; then
+ if [ $raw_socket_check -ne 0 ]; then
+ return 1
+ elif [ $ss_available -ne 0 -o $sockstat_available -ne 0 ]; then
if [ $ss_available -ne 0 ]; then
port_info=$($socket_utility $ss_opts -t "( sport = :$port )" 2>/dev/null | \
grep -E '[[:space:]]users:[[:space:]]?\(' | \
@@ -163,7 +165,10 @@ check_pid_and_port()
fi
fi
- check_pid "$pid_file" && [ $CHECK_PID -eq $pid ]
+ if [ $raw_socket_check -ne 0 ]; then
+ return 0
+ fi
+ check_pid "$pid_file" && [ "$CHECK_PID" -eq "$pid" ]
}
get_binlog

5
SOURCES/mariadb.tmpfiles.d.in
View File

@ -1,3 +1,8 @@
# Do not edit this file.
# To override this, put /etc/tmpfiles.d/mariadb.conf instead.
d @PID_FILE_DIR@ 0755 mysql mysql -
# Rules for ephemeral file systems (ImageMode)
d /var/lib/mysql 0755 mysql mysql -
d /var/log/mariadb 0750 mysql mysql -
f /var/log/mariadb/mariadb.log 0660 mysql mysql -

1
SOURCES/rh-skipped-tests-base.list
View File

@ -107,3 +107,4 @@ mariabackup.rpl_clone_slave :
# Fails on 10.5.27
main.timezone :
main.alter_table_combinations :

33
SPECS/mariadb.spec
View File

@ -158,7 +158,7 @@ ExcludeArch: %{ix86}
Name: mariadb
Version: 10.5.29
Release: 1%{?with_debug:.debug}%{?dist}
Release: 5%{?with_debug:.debug}%{?dist}
Epoch: 3
Summary: A very fast and robust SQL database server
@ -226,6 +226,12 @@ Patch10: %{pkgnamepatch}-ssl-cipher-tests.patch
# Patch14: make MTR port calculation reasonably predictable
Patch14: %{pkgnamepatch}-mtr.patch
Patch18: CVE-2025-13699.patch
# Patch19: avoid AVC denials during Galera SST, upstream commit
# Upstream commit: 5a8cd03f0f3ae9fbcc3b6f33843d030d840f6e2f
Patch19: %{pkgnamepatch}-mdev-37899-selinux-avc.patch
BuildRequires: make
BuildRequires: cmake gcc-c++
BuildRequires: multilib-rpm-config
@ -757,6 +763,8 @@ rm -r storage/rocksdb/
# Keeping the patch commented out, need to revisit
# once the test is re-enabled by upstream in some future release
#%%patch10 -p1
%patch18 -p1
%patch19 -p1
# generate a list of tests that fail, but are not disabled by upstream
cat %{SOURCE50} | tee -a mysql-test/unstable-tests
@ -777,6 +785,12 @@ cat %{SOURCE53} | tee -a mysql-test/unstable-tests
cp %{SOURCE2} %{SOURCE3} %{SOURCE10} %{SOURCE11} %{SOURCE12} \
%{SOURCE14} %{SOURCE15} %{SOURCE16} %{SOURCE18} %{SOURCE70} %{SOURCE73} scripts
# Create a sysusers.d config file
# To enforce UID 27 for Image Mode
cat > support-files/sysusers.conf.in << EOF
u mysql 27 'MariaDB and MySQL Server' %{dbdatadir} -
EOF
%if %{with galera}
# prepare selinux policy
mkdir selinux
@ -993,9 +1007,6 @@ install -p -m 644 %{_vpath_builddir}/scripts/mariadb-scripts-common %{buildroot}
# Install downstream version of tmpfiles
install -D -p -m 0644 %{_vpath_builddir}/scripts/mariadb.tmpfiles.d %{buildroot}%{_tmpfilesdir}/%{name}.conf
%if 0%{?mysqld_pid_dir:1}
echo "d %{pidfiledir} 0755 mysql mysql -" >>%{buildroot}%{_tmpfilesdir}/%{name}.conf
%endif
# install additional galera selinux policy
%if %{with galera}
@ -1518,6 +1529,7 @@ fi
%{_libexecdir}/mariadb-check-upgrade
%{_libexecdir}/mariadb-scripts-common
# Remember to also update the mariadb.tmpfiles.d.in file when updating these permissions
%attr(0755,mysql,mysql) %dir %{pidfiledir}
%attr(0755,mysql,mysql) %dir %{dbdatadir}
%attr(0750,mysql,mysql) %dir %{logfiledir}
@ -1655,6 +1667,19 @@ fi
%endif
%changelog
* Wed Aug 05 2026 Nikola Davidova <ndavidov@redhat.com> - 3:10.5.29-5
- Backport MDEV-37899 to prevent excessive SELinux AVC denials during Galera SST
- Resolves: INFRASERV-1809
* Tue Apr 28 2026 Petr Khartskhaev <pkhartsk@redhat.com> - 3:10.5.29-4
- Bump release for tmpfiles.d change
* Tue Dec 02 2025 Pavol Sloboda <psloboda@redhat.com> - 3:10.5.29-3
- Release bump for rebuild
* Wed Oct 01 2025 Pavol Sloboda <psloboda@redhat.com> - 3:10.5.29-2
- Release bump for rebuild
* Mon Aug 25 2025 Pavol Sloboda <psloboda@redhat.com> - 3:10.5.29-1
- Rebase to 10.5.29